Merge from intsign.

diff --cc src/ChangeLog
index f7f68b41838a9adf89eb314363eb312898afa4f5,b72de32ffc3d49364de7e440ae930042fdf61c6b..30af92a57e91f5f79e1d1c7ca3035a5e3235d1bb
--- 1/src/ChangeLog
--- 2/src/ChangeLog
+++ b/src/ChangeLog
@@@ -1,111 -1,5 +1,113 @@@
 +2011-07-19  Paul Eggert  <eggert@cs.ucla.edu>
 +
 +      Use ptrdiff_t for hash table indexes.
 +      * category.c (hash_get_category_set):
 +      * ccl.c (ccl_driver):
 +      * charset.h (struct charset.hash_index, CHECK_CHARSET_GET_ID):
 +      * coding.c (coding_system_charset_list, detect_coding_system):
 +      * coding.h (struct coding_system.id):
 +      * composite.c (get_composition_id, gstring_lookup_cache):
 +      * fns.c (hash_lookup, hash_put, Fgethash, Fputhash):
 +      * image.c (xpm_get_color_table_h):
 +      * lisp.h (hash_lookup, hash_put):
 +      * minibuf.c (Ftest_completion):
 +      Use ptrdiff_t for hash table indexes, not int (which is too
 +      narrow, on 64-bit hosts) or EMACS_INT (which is too wide, on
 +      32-bit --with-wide-int hosts).
 +
 +      * charset.c (Fdefine_charset_internal): Check for integer overflow.
 +      Add a FIXME comment about memory leaks.
 +      (syms_of_charset): Don't assume xmalloc returns.
 +
 +      Don't assume that stated character widths fit in int.
 +      * character.c (Fchar_width, c_string_width, lisp_string_width):
 +      * character.h (CHAR_WIDTH):
 +      * indent.c (MULTIBYTE_BYTES_WIDTH):
 +      Use sanitize_char_width to avoid undefined and/or bad behavior
 +      with outlandish widths.
 +      * character.h (sanitize_tab_width): Renamed from sanitize_width,
 +      now that we have two such functions.  All uses changed.
 +      (sanitize_char_width): New inline function.
 +
 +      Don't assume that tab-width fits in int.
 +      * character.h (sanitize_width): New inline function.
 +      (SANE_TAB_WIDTH): New macro.
 +      (ASCII_CHAR_WIDTH): Use it.
 +      * indent.c (sane_tab_width): Remove.  All uses replaced by
 +      SANE_TAB_WIDTH (current_buffer).
 +      * xdisp.c (init_iterator): Use SANE_TAB_WIDTH.
 +
 +      * fileio.c: Integer overflow issues with file modes.
 +      (Fset_file_modes, auto_save_1): Don't assume EMACS_INT fits in int.
 +
 +      * charset.c (read_hex): New arg OVERFLOW.  All uses changed.
 +      Remove unreachable code.
 +      (read_hex, load_charset_map_from_file): Check for integer overflow.
 +
 +      * xterm.c: don't go over XClientMessageEvent limit
 +      (scroll_bar_windows_size): Now ptrdiff_t, as we prefer signed.
 +      (x_send_scroll_bar_event): Likewise.  Check that the size does not
 +      exceed limits imposed by XClientMessageEvent, as well as the usual
 +      ptrdiff_t and size_t limits.
 +
 +      * keyboard.c: Overflow, signedness and related fixes.
 +      (make_lispy_movement): Use same integer type in forward decl
 +      that is used in the definition.
 +      (read_key_sequence, keyremap_step):
 +      Change bufsize argument back to int, undoing my 2011-03-30 change.
 +      We prefer signed types, and int is wide enough here.
 +      (parse_tool_bar_item): Don't assume tool_bar_max_label_size is less
 +      than TYPE_MAXIMUM (EMACS_INT) / 2.  Don't let the label size grow
 +      larger than STRING_BYTES_BOUND.  Use ptrdiff_t for Emacs string
 +      length, not size_t.  Use ptrdiff_t for index, not int.
 +      (keyremap_step, read_key_sequence): Redo bufsize check to avoid
 +      possibility of integer overflow.
 +
 +      Overflow, signedness and related fixes for images.
 +
 +      * dispextern.h (struct it.stack[0].u.image.image_id)
 +      (struct_it.image_id, struct image.id, struct image_cache.size)
 +      (struct image_cache.used, struct image_cache.ref_count):
 +      * gtkutil.c (update_frame_tool_bar):
 +      * image.c (x_reference_bitmap, Fimage_size, Fimage_mask_p)
 +      (Fimage_metadata, free_image_cache, clear_image_cache, lookup_image)
 +      (cache_image, mark_image_cache, x_kill_gs_process, Flookup_image):
 +      * nsmenu.m (update_frame_tool_bar):
 +      * xdisp.c (calc_pixel_width_or_height):
 +      * xfns.c (image_cache_refcount):
 +      Image IDs are now ptrdiff_t, not int, to avoid arbitrary limits
 +      on typical 64-bit hosts.
 +
 +      * image.c (RANGED_INTEGERP, TYPE_RANGED_INTEGERP): New macros.
 +      (x_bitmap_pixmap, x_create_x_image_and_pixmap):
 +      Omit unnecessary casts to int.
 +      (parse_image_spec): Check that integers fall into 'int' range
 +      when the callers expect that.
 +      (image_ascent): Redo ascent calculation to avoid int overflow.
 +      (clear_image_cache): Avoid overflow when sqrt (INT_MAX) < nimages.
 +      (lookup_image): Remove unnecessary tests.
 +      (xbm_image_p): Locals are now of int, not EMACS_INT,
 +      since parse_image_check makes sure they fit into int.
 +      (png_load, gif_load, svg_load_image):
 +      Prefer int to unsigned where either will do.
 +      (tiff_handler): New function, combining the cores of the
 +      old tiff_error_handler and tiff_warning_handler.  This
 +      function is rewritten to use vsnprintf and thereby avoid
 +      stack buffer overflows.  It uses only the features of vsnprintf
 +      that are common to both POSIX and native Microsoft.
 +      (tiff_error_handler, tiff_warning_handler): Use it.
 +      (tiff_load, gif_load, imagemagick_load_image):
 +      Don't assume :index value fits in 'int'.
 +      (gif_load): Omit unnecessary cast to double, and avoid double-rounding.
 +      (imagemagick_load_image): Check that crop parameters fit into
 +      the integer types that MagickCropImage accepts.  Don't assume
 +      Vimagemagick_render_type has a nonnegative value.  Don't assume
 +      size_t fits in 'long'.
 +      (gs_load): Use printmax_t to print the widest integers possible.
 +      Check for integer overflow when computing image height and width.
 +
+ 2011-07-19  Paul Eggert  <eggert@cs.ucla.edu>
+ 
        Integer signedness and overflow and related fixes.  (Bug#9079)
  
        * bidi.c: Integer size and overflow fixes.

diff --cc src/minibuf.c
Simple merge